Privacy Policy

ALEBETH HOLDINGS LLC · Last updated 20 September 2026 · Effective 1 September 2026

The short version. We hold your email address, the trips you ask for, and the itineraries we write for you. We do not track you, we run no advertising, we have no analytics, and we do not sell or share your information for anyone else's marketing.

What we collect

Everything below is collected because a specific feature needs it. There is no category collected “just in case”.

What	Why we have it	How long
Email address	Signing you in, verifying the address, resetting a password, and stopping one person opening unlimited free accounts	Until you delete your account
Password	Signing you in. Stored only as an Argon2id hash — we cannot read your password, and neither can anyone who obtains a copy of our database	Until you delete your account
The IP address you signed up from	Detecting one address opening many accounts	90 days, then erased automatically even if you keep the account
Your trip requests	Generating the itinerary, and letting you re-open it later	Until you delete your account
The itineraries we generate	They are the product — you can re-read, export and share them	Until you delete your account
Your credit balance and its history	Knowing what you have bought and spent, and refunding a generation that fails	Until you delete your account
Purchase records	Making sure a purchase is credited exactly once, and as a record of a real payment	Kept after account deletion, detached from you
Rate-limiting counters	Slowing down password guessing and scraping. Addresses and emails are hashed before they are stored, so these hold nothing that identifies you	Deleted after a day of inactivity

What we do not collect

No device location. You type a city name; we never ask your device where it is.
No analytics or usage tracking. No third-party analytics SDK is present in the app or the API.
No advertising identifiers, and no advertising. We do not build a profile of you, and nothing about you is sold or shared for anyone's marketing.
No contacts, photos, calendar, or health data.
No payment card details. Apple and Google take the payment; we only ever receive a receipt confirming one happened.

Who else sees your information

We use a small number of services to run Wayfarely. Each receives only what its job requires.

Service	What it receives	What for
Anthropic	Your trip request: cities, dates, budget, interests, group size and travel style. Not your email address, your account id, or any other identifier	Writing the itinerary
Our email provider	Your email address, and the verification or password-reset link being sent to it	Delivering those emails — we send no marketing email
Render	Everything above, because they host the servers and the database	Hosting, in the United States
Apple and Google	Handled entirely by them; we receive a receipt	Taking payment for credit packs

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We will disclose information if the law requires it of us.

Itineraries you choose to share

Sharing an itinerary creates a secret link that anyone holding it can open, without an account. This is deliberate — it is how you send a trip to the people going on it.

The shared page shows the itinerary and the trip dates only. Never your email address, your account id, your budget, or the rest of what you entered.
You choose how long the link lasts, from one hour to seven days. You can turn it off at any time, which deletes it immediately.
Shared pages ask search engines not to index them, and the link is not passed on to sites you reach from the page.
Be aware that the itinerary text itself can name your departure airport, because it is part of the trip. Only share with people you would tell.

Deleting your account

You can delete your account from inside the app, and it deletes for real.

Erased: your email address, your password hash, your signup address, every trip request, every itinerary, every share link, and your credit history.

Kept: the record that a store purchase happened — the transaction id, the pack, the date — with your account removed from it. We keep this because it is a financial record, and because it is what stops the same receipt being redeemed again by a new account. It no longer identifies you.

If an administrator has ever acted on your account, that entry is kept for accountability, with your email address redacted.

Deletion is immediate and cannot be undone. Any credits you have not spent are lost.

How we protect it

Passwords are hashed with Argon2id and are never stored or logged in readable form.
Traffic to the API travels over HTTPS; the database is encrypted at rest by our host and accepts no connections from the public internet.
Signing in is rate-limited, and sessions can be ended everywhere at once from inside the app — which is also what a password reset does.
Staff access is restricted, requires two-factor authentication, and every privileged action is written to an append-only audit log.
Email addresses are masked in our logs.

No system is perfect, and we do not claim otherwise. What we can say is that these are the controls in place, and they are documented and tested rather than asserted.

Your rights

Whoever and wherever you are, you can:

See what we hold — your trips and itineraries are in the app; write to us for the rest.
Correct it — write to us.
Delete it — from inside the app, at any time, without asking us.
Take it with you — export any itinerary as a PDF.

If you are in California

The CCPA gives you the right to know what is collected, to have it deleted, to correct it, and not to be discriminated against for asking. We do not sell personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of. Exercise any of these by writing to admin@alebethholdings.com.

Wayfarely is offered in the United States only. If that changes we will update this policy before opening elsewhere.

Children

Wayfarely is not intended for children under 13, and we do not knowingly collect their information. Write to us if you believe a child has created an account and we will delete it.

Changes

If we change this policy we will update the date at the top, and tell you in the app before any change that materially affects what we collect or who sees it.

Contact

admin@alebethholdings.com
ALEBETH HOLDINGS LLC
63 Bovet Road, Suite 203
San Mateo, CA 94402
United States